fix(ci): use CI_GITHUB_TOKEN to bypass branch protection for releases

[jbdevprimary]

Summary

Critical fix to unblock automated release workflow.

Problem

semantic-release workflow is failing with:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Changes must be made through a pull request.

The release workflow needs to push version bump commits directly to main, but branch protection rules prevent this.

Solution

Use CI_GITHUB_TOKEN (which has bypass permissions) instead of GITHUB_TOKEN for:

• Checking out code in release job
• Pushing version bumps via semantic-release
• Creating GitHub releases

Changes

• Line 121: checkout uses CI_GITHUB_TOKEN
• Line 147: semantic-release uses CI_GITHUB_TOKEN
• Line 172: GitHub release creation uses CI_GITHUB_TOKEN

Impact

✅ Unblocks automated releases to PyPI and GitHub
✅ Enables 1.0 stable release process
✅ No breaking changes to workflow behavior

Testing

Will be validated when this PR merges and triggers the release workflow on main.

---

Note

Unblocks automated releases by granting the release job push/release permissions via CI_GITHUB_TOKEN.

• In ci.yml release job: actions/checkout, semantic-release (GH_TOKEN), and softprops/action-gh-release now use secrets.CI_GITHUB_TOKEN
• No application code changes; updated memory-bank/activeContext.md with current status and next steps for 1.0

^{Written by Cursor Bugbot for commit 3dcb110. This will update automatically on new commits. Configure here.}